<html>
<head><meta charset="utf-8"><title>Possible UB on x86? · general · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/index.html">general</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html">Possible UB on x86?</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="229217346"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229217346" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Soveu <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229217346">(Mar 07 2021 at 20:59)</a>:</h4>
<p>i was thinking if this code is sound</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">pub</span><span class="w"> </span><span class="k">fn</span> <span class="nf">f</span><span class="p">(</span><span class="n">x</span>: <span class="kp">&amp;</span><span class="p">[</span><span class="kt">u8</span><span class="p">;</span><span class="w"> </span><span class="mi">8</span><span class="p">])</span><span class="w"> </span>-&gt; <span class="kt">u64</span> <span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kt">u64</span>::<span class="n">from_ne_bytes</span><span class="p">(</span><span class="o">*</span><span class="n">x</span><span class="p">)</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>
<p>pretty simple, but it generates this assembly</p>
<div class="codehilite" data-code-language="GAS"><pre><span></span><code><span class="nl">example:</span><span class="err">:</span><span class="nl">f:</span>
        <span class="nf">mov</span>     <span class="no">rax</span><span class="p">,</span> <span class="no">qword</span> <span class="no">ptr</span> <span class="p">[</span><span class="no">rdi</span><span class="p">]</span>
        <span class="nf">ret</span>
</code></pre></div>
<p>it is possible for OS to turn on the alignment check bit on x86, making this code crash</p>



<a name="229217662"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229217662" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229217662">(Mar 07 2021 at 21:04)</a>:</h4>
<p>References are guaranteed to be aligned and non-null.</p>



<a name="229217721"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229217721" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229217721">(Mar 07 2021 at 21:04)</a>:</h4>
<p>but this is a reference to u8 array, so alignment of the value is 1.</p>



<a name="229217733"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229217733" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229217733">(Mar 07 2021 at 21:05)</a>:</h4>
<p>Oh <span aria-label="eyes" class="emoji emoji-1f440" role="img" title="eyes">:eyes:</span> yeah this looks troublesome then</p>



<a name="229217773"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229217773" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229217773">(Mar 07 2021 at 21:05)</a>:</h4>
<p>Don't most compilers ban the use of the AC bit on x86?</p>



<a name="229217822"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229217822" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229217822">(Mar 07 2021 at 21:06)</a>:</h4>
<p>I don't think it is troublesome. If this was something people needed, this would be a target property settable for the target that does for some reason utilize the align check.</p>



<a name="229217825"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229217825" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229217825">(Mar 07 2021 at 21:06)</a>:</h4>
<p>that's on par with messing with FP flags</p>



<a name="229217884"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229217884" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229217884">(Mar 07 2021 at 21:07)</a>:</h4>
<p>I mean that the compiler is going to assume that the AC bit is off most of the time, and you can turn it on in assembly blocks but only if you turn it off again before handing off to the compiler</p>



<a name="229218175"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229218175" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229218175">(Mar 07 2021 at 21:11)</a>:</h4>
<p>Also, at the LLVM level that's an unaligned read.  So one could presumably pass a flag to LLVM telling it not to use normal <code>mov</code>s for unaligned reads if you're going to turn on the AC bit for the code.</p>



<a name="229218501"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229218501" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229218501">(Mar 07 2021 at 21:16)</a>:</h4>
<p>Curiously neither gcc nor llvm/clang appear to expose a flag to change this behaviour.</p>



<a name="229218517"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229218517" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229218517">(Mar 07 2021 at 21:16)</a>:</h4>
<p>which likely means nobody ever wanted AC-compatible behaviour.</p>



<a name="229218563"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229218563" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229218563">(Mar 07 2021 at 21:17)</a>:</h4>
<p>Also glibc will <del>segfault</del> #AC fault if you leave the AC bit on in those functions, they are not at all hardened against it</p>



<a name="229228928"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229228928" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229228928">(Mar 08 2021 at 00:02)</a>:</h4>
<p>I do think it'd be entirely reasonable to consider "x86 with alignment checks turned on" as an entirely different target (that for the most part nobody wants).</p>



<a name="229229174"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229229174" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229229174">(Mar 08 2021 at 00:06)</a>:</h4>
<p>These days, if you want to detect alignment issues, you'd use performance counters to detect unaligned accesses.</p>



<a name="229241184"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229241184" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229241184">(Mar 08 2021 at 03:13)</a>:</h4>
<p>On ARM targets you specifically have to enable the <code>+strict-align</code> LLVM feature otherwise LLVM assumes that normal load/store instructions work with unaligned addresses.</p>



<a name="229241193"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229241193" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229241193">(Mar 08 2021 at 03:13)</a>:</h4>
<p>In fact, we do this for some of the embedded Thumb targets which don't support unaligned accesses in hardware.</p>



<a name="229264244"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229264244" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Soveu <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229264244">(Mar 08 2021 at 08:36)</a>:</h4>
<p><code>+strict-align</code> is not a target feature on x86 though :/</p>



<a name="229371865"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229371865" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229371865">(Mar 08 2021 at 20:54)</a>:</h4>
<p><span class="user-mention" data-user-id="328907">@Soveu</span> Do you have a specific use case for x86-with-alignment-check-enabled?</p>



<a name="229379516"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229379516" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Soveu <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229379516">(Mar 08 2021 at 21:45)</a>:</h4>
<p><span class="user-mention silent" data-user-id="239881">Josh Triplett</span> <a href="#narrow/stream/122651-general/topic/Possible.20UB.20on.20x86.3F/near/229371865">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="328907">Soveu</span> Do you have a specific use case for x86-with-alignment-check-enabled?</p>
</blockquote>
<p>Not really, just curiosity</p>



<a name="229384007"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229384007" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229384007">(Mar 08 2021 at 22:09)</a>:</h4>
<p>Then I think ideally we should avoid introducing such a feature.</p>



<a name="229384178"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/122651-general/topic/Possible%20UB%20on%20x86%3F/near/229384178" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/122651-general/topic/Possible.20UB.20on.20x86.3F.html#229384178">(Mar 08 2021 at 22:10)</a>:</h4>
<p>It's sufficiently unused that current x86 actually repurposes the bit in supervisor mode. (OSes have to opt in, but you can't use both features at the same time, and the assumption is that nobody cared about using alignment check.)</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>